1688 Price Monitor

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward 1688 price lookup helper with ordinary network and Python dependency risk, but no hidden persistence, credential access, destructive behavior, or exfiltration in the inspected artifacts.

Before installing, treat it as a simple 1688 lookup tool rather than a full monitoring system. Use a virtual environment, consider pinning requests yourself, and verify prices and suppliers directly before making purchasing or business decisions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependency Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–19
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

yaml

"install":
  [
    {
      "id": "requests",
      "kind": "pip",
      "package": "requests",
      "label": "安装依赖：pip3 install requests",
    },
  ],

Technical Analysis

The Skill installs the requests package without pinning a reviewed version or verifying the downloaded artifact with a cryptographic hash. As a result, installation resolves whichever package version the configured Python package index serves at that time.

Although requests is a legitimate and correctly spelled package, the absence of version and integrity constraints makes the installed dependency mutable after this audit. A compromised package release, package-index account, repository, mirror, or dependency-resolution environment could introduce attacker-controlled code. Such code may execute during installation or when tools/query_price.py imports requests.

No evidence indicates that the current dependency is malicious. The risk arises from insufficient supply-chain controls.

Attack Path

1. An attacker compromises a package release, publishing account, configured package mirror, or dependency-resolution environment.
2. A user installs the Skill's dependency using the unpinned pip3 install requests instruction.
3. Pip resolves and downloads an attacker-controlled or compromised artifact because no approved version or hash is enforced.
4. Malicious package code executes during installation or when query_price.py imports the package.
5. The code runs with the permissions and environmental access of the user operating the Skill.

Impact Assessment

Successful exploitation could provide arbitrary Python code execution under the installing or executing user's account. The accessible scope could include files, environment variables, n ...[truncated 190 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests and all transitive dependencies to explicitly reviewed versions in a lock file.
2. Record SHA-256 hashes for every approved distribution and install with hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Use an explicitly trusted package index and prevent unintended fallback to untrusted or privately configured mirrors.
4. Prefer a dedicated virtual environment with only the permissions required by the Skill.
5. Integrate dependency vulnerability scanning and controlled update reviews into release maintenance.
6. Update the Skill metadata so installation references the locked, hash-verified dependency manifest rather than the unconstrained package name.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared capabilities materially differ from the behavior described by analysis: the skill claims ongoing monitoring, same-item comparison, and dropshipping-specific pricing, but appears to perform only one-off lookups and even adds undeclared profit calculation. Capability mismatch is dangerous because users and orchestrators may grant trust, permissions, or invoke the skill under false assumptions, increasing the chance of misuse or misleading business decisions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises network-dependent behavior via required binaries and the described 1688 lookups, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates a transparency and least-privilege problem: the runtime may permit outbound access without the user or platform having a clearly constrained policy for what hosts or tools the skill may contact.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents invocation examples, so vague-trigger review applies. The phrase asks to find the lowest wholesale price for a similar product without explicitly constraining the request to 1688 or this skill, making activation boundaries unclear and increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Natural-language policy review applies to all file types, including markdown. The file consistently forces a single language for description and user interaction examples, but does not state that the skill is region-specific or provide any opt-in or alternative language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The request headers explicitly set Accept-Language to prefer zh-CN, which imposes a specific language/locale behavior. The file does not offer users a locale choice or explain why this restriction is required, so it conflicts with the language/locale policy guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.